It very much is the norm, lots of security research companies have similar policies. It’s called coordinated vulnerability disclosure, or CVD. Rapid 7 is throwi

It very much is the norm, lots of security research companies have similar policies. It’s called coordinated vulnerability disclosure, or CVD. Rapid 7 is throwing the random company under the bus to protect users of that company’s software. And of course to market Rapid 7.